Allow view-source of pages fully-blocked by Blink's XSS filter.

content/browser/frame_host/navigation_controller_impl_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/path_service.h"
 #include "base/stl_util.h"
@@ skipping 4311 matching lines @@
   params.is_post = false;
   params.post_id = -1;
   test_rvh()->SendNavigateWithParams(&params);
 
   // Now reload. replaceState overrides the POST, so we should not show a
   // repost warning dialog.
   controller_impl().Reload(true);
   EXPECT_EQ(0, delegate->repost_form_warning_count());
 }
 
+// Test that the navigation controller preserves an entry when a
+// "Blocking Page" is created.
+TEST_F(NavigationControllerTest, BlockingPageEntry) {
+  const GURL url1("http://foo1");
+  const GURL url2("http://foo2?x=<script>alert(0)</script>");
+  const GURL url3("data:,");
+  const GURL url4("http://foo4");
+
+  NavigationControllerImpl& controller = controller_impl();
+
+  // Set up the controller with initial history.
+  NavigateAndCommit(url1);
+  NavigateAndCommit(url2);
+  EXPECT_FALSE(controller.GetBlockedPageEntry());
+
+  // Pretend that XSS was detected by the renderer.
+  int32 page_id = controller.GetActiveEntry()->GetPageID();
+  contents()->OnDidDetectXSS(page_id, url2, true);
+  EXPECT_TRUE(controller.GetBlockedPageEntry());
+  EXPECT_EQ(url2, controller.GetBlockedPageEntry()->GetURL());
+
+  // Pretend that a "Blocking Page" replacement navigation followed.
+  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  params.page_id = page_id;
+  params.url = url3;
+  params.transition = PAGE_TRANSITION_LINK;
+  params.gesture = NavigationGestureUser;
+  params.page_state = PageState::CreateFromURL(params.url);
+  params.was_within_same_page = true;
+  params.is_post = false;
+  params.post_id = -1;
+  test_rvh()->SendNavigateWithParams(&params);
+  EXPECT_TRUE(controller.GetBlockedPageEntry());
+  EXPECT_EQ(url2, controller.GetBlockedPageEntry()->GetURL());
+
+  // Check that further navigation clears the entry.
+  NavigateAndCommit(url4);
+  EXPECT_FALSE(controller.GetBlockedPageEntry());
+}
+
 }  // namespace content